TLA + is a specification language based on standard set theory and temporal logic that has constructs for hierarchical proofs. We describe how to write TLA + proofs and check them with TLAPS, the TLA + Proof System. We use Peterson's mutual exclusion algorithm as a simple example to describe the features of TLAPS and show how it and the Toolbox (an IDE for TLA + ) help users to manage large, complex proofs.1 The TLA + module containing the specification and proof is accessible at the TLAPS Web page [20].2 The figure shows the pretty-printed version of PlusCal code and TLA + formulas. As an example of how they are typed, here is the ascii version of the variables declaration: variables flag = [i \in {0, 1} |-> FALSE], turn = 0;

Abstract. TLA + is a formal specification language that is based on ZF set theory and the Temporal Logic of Actions TLA. The TLA + proof system tlaps assists users in deductively verifying safety properties of TLA + specifications. tlaps is built around a proof manager, which interprets the TLA + proof language, generates corresponding proof obligations, and passes them to backend verifiers. In this paper we present a new backend for use with SMT solvers that supports elementary set theory, functions, arithmetic, tuples, and records. Type information required by the solvers is provided by a typing discipline for TLA + proof obligations, which helps us disambiguate the translation of expressions of (untyped) TLA + , while ensuring its soundness. Preliminary results show that the backend can help to significantly increase the degree of automation of certain interactive proofs.